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JAN  2  7  2012 

MEMORANDUM  FOR  AUDITOR  GENERAL,  DEPARTMENT  OF  THE  ARMY 

SUBJECT:  Quality  Control  Review  of  Army  Audit  Agency’s  Special  Access 
Program  Audits  (Report  No.  DODIG-20 12-045) 

We  are  providing  this  report  for  your  information  and  use.  We  reviewed  the  Army  Audit 
Agency’s  (AAA)  system  of  quality  control  over  Special  Access  Programs  (SAP)  audits 
for  the  two  years  ended  September  30,  2010.  The  generally  accepted  government 
auditing  standards  (GAGAS)  require  that  an  audit  organization  performing  audits  and/or 
attestation  engagements  in  accordance  with  GAGAS  should  have  an  appropriate  internal 
quality  control  system  in  place  and  undergo  an  external  peer  review  at  least  once  every 
three  years  by  reviewers  independent  of  the  audit  organization  being  reviewed.  As  the 
organization  that  has  audit  policy  and  oversight  responsibilities  for  audits  in  the  DOD,  we 
conducted  the  external  quality  control  review  of  the  AAA  SAP  audits  in  conjunction  with 
the  Naval  Audit  Service’s  review  of  the  AAA  non-SAP  audits. 

An  audit  organization’s  quality  control  policies  and  procedures  should  be  appropriately 
comprehensive  and  suitably  designed  to  provide  reasonable  assurance  of  meeting  the 
objectives  of  quality  control.  We  tested  the  AAA  SAP  system  of  quality  control  for 
audits  to  the  extent  considered  appropriate. 

Federal  audit  organizations  can  receive  a  rating  of  pass,  pass  with  deficiencies,  ox  fail.  In 
our  opinion,  the  system  of  quality  control  for  the  audit  function  of  AAA  SAP  in  effect  for 
the  period  ended  September  30,  2010,  was  designed  in  accordance  with  quality  standards 
established  by  GAGAS.  Further,  the  internal  quality  control  system  was  operating 
effectively  to  provide  reasonable  assurance  that  SAP  audit  personnel  were  following 
established  policies,  procedures,  and  applicable  auditing  standards.  Accordingly,  we  are 
issuing  a  pass  opinion  on  your  SAP  audit  quality  control  system  for  the  review  period 
ended  September  30,  2010. 

Appendix  A  contains  comments,  observations  and  recommendations  where  AAA  can 
improve  its  quality  control  system.  Appendix  B  contains  the  scope  and  methodology  of 
the  review.  We  appreciate  the  courtesies  extended  to  the  staff.  Questions  should  be 
directed  to  Ms.  Carolyn  R.  Davis  at  (703)  604-8877  (DSN  664-8877)  or 
carolyn.davis@dodig.mil. 


Randolph  R.  Stone,  SES 
Deputy  Inspector  General 
Policy  and  Oversight 


Appendix  A.  Comments,  Observations,  and 
Recommendations 

We  are  issuing  a  pass  opinion  because  we  determined  that  the  Army  Audit  Agency’s 
(AAA)  quality  control  system  is  adequately  designed  and  functioning  as  prescribed.  The 
concerns  we  identified  during  our  review  of  the  selected  AAA  audit  reports  were  not 
cumulatively  significant  enough  to  indicate  that  material  deficiencies  existed  in  the  AAA 
quality  control  system  for  complying  with  generally  accepted  government  auditing 
standards  (GAGAS). 

We  identified  areas  of  concern  relating  to  independence,  planning,  audit  documentation, 
and  quality  control.  We  judgmentally  tested  the  reports  for  compliance  with  GAGAS  and 
AAA  audit  policies  in  nine  areas  to  include  independence,  professional  judgment, 
competence,  audit  planning,  supervision,  evidence,  audit  documentation,  reporting  and 
quality  control. 

Independence 

We  found  that  the  program  director  did  not  sign  the  independence  statement  for  the  audit 
manager  which  was  documented  in  the  audit  working  paper  files  for  one  of  the  two  audits 
reviewed. 

GAGAS  3.02  (2007  Revision)  states  that  in  all  matters  relating  to  the  audit  work,  the 
audit  organization  and  the  individual  auditor,  whether  government  or  public,  must  be  free 
from  personal,  external,  and  organizational  impairments  to  independence,  and  must  avoid 
the  appearance  of  such  impairments  of  independence. 

USAAA  Regulation  No.  36-3,  Audit  Survey  and  Execution,  dated  October  17,  2003, 
Chapter  2,  Section  4,  Independence  states  that  to  comply  with  the  independence  standard, 
the  Auditor-in-Charge  must  determine  and  document  whether  any  audit  team  members 
have  any  personal  impairments  to  independence  based  on  the  audited  activity  or  subject 
matter  of  the  audit.  Auditors  are  responsible  for  notifying  audit  management  if  they  have 
a  personal  impairment  to  independence.  This  must  be  completed  before  starting  any 
audit  work. 

While  the  audit  documentation  did  not  include  a  signed  independence  statement  for  the 
audit  manager,  the  independence  statements  for  all  other  auditors  assigned  to  the  audit, 
including  the  program  director  and  auditor-in-charge,  were  also  part  of  the  audit 
documentation.  The  audit  manager  stated  that  it  was  an  oversight  that  the  independence 
statement  was  not  documented  in  the  audit  files. 

Recommendation 

We  recommend  that  the  AAA  Program  Director  for  Intelligence  and  Security  audits 
remind  auditors  to  follow  AAA  guidance  for  preparing,  reviewing  and  documenting 
auditor  independence  for  all  auditors  assigned  to  the  audit  to  include  audit  managers. 
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Management  Comments 

The  Army  Audit  Agency’s  Deputy  Auditor  General  concurred  with  the  recommendation  and 
stated  that  on  December  7,  201 1,  the  program  director  sent  an  e-mail  to  all  special  access 
program  personnel  discussing  the  results  of  the  quality  control  review  and  re-emphasized  the 
requirements  of  USAAA  Regulation  No.  36-3  (Audit  Survey  and  Execution)  relating  to  the 
need  for  auditors,  specialists  and  independent  reviewers  to  review  and  sign  independence 
statements  upon  assignment  to  an  engagement. 

Reviewer  Response 

Management  comments  are  responsive.  The  program  director’s  December  7,  201 1 
e-mail  requires  that  the  auditors  follow  USAAA  Regulation  No.  36-2  by  including 
independence  statements  in  the  working  papers  and  having  the  appropriate  supervisor 
sign  the  independence  statements. 

Planning 

We  found  that  for  one  of  the  two  audits  reviewed,  the  auditors  did  not  prepare 
audit  working  papers  or  memorandums  for  record  to  document  meetings  with 
AAA  management  regarding  progress  and  results  of  audited  areas. 

GAGAS  7.12e  (2007  Revision)  states  that  auditors  should  communicate  about 
planning  and  performance  of  the  audit  to  management  officials,  those  charged 
with  governance,  and  others  as  applicable. 

USAAA  Regulation  No.  36-2,  Planning  the  Audit,  dated  February  24,  2009,  Section  8-1, 
Purpose  of  Planning  Decision  Gate  states  that  decision  gates  allow  for  program  directors, 
audit  managers,  and  Auditors-in-Charge  to  plan  and  conduct  engagements  and  to  reach 
agreements  on  how  engagement  results  will  be  presented  in  the  report.  The  intent  of  the 
decision  gates  is  to  ensure  all  engagements  are  managed  more  effectively  and  feedback  is 
provided  to  the  customer  in  a  timely  manner.  Typical  Agency  audits  and  attestation 
engagements  require  four  decision  gates:  planning,  30  percent  in-process  review,  60 
percent  review,  and  message  agreement.  The  primary  purpose  of  the  planning  decision 
gate  meeting  is  to  ensure  that  the  auditors  are  in  agreement  on  the  focus  of  the 
engagement  and  that  the  auditors  have  the  capability  to  perform  the  engagement  as 
planned. 

USAAA  Regulation  No.  36-2,  Planning  the  Audit,  dated  February  24,  2009,  Section  8-4, 
Documenting  the  Planning  Meeting  states  that  the  Auditor-in-Charge  is  responsible  for 
ensuring  the  planning  meeting,  and  any  decisions  made  therein,  is  documented. 

Since  the  audit  documentation  did  not  contain  a  working  paper  or  memorandum  of  the 
meetings  between  the  Army  auditors  and  AAA  audit  management  regarding  the  progress 
of  the  audit,  we  could  not  determine  whether  audit  management  either  approved  the 
progress  of  the  audit  plan  that  the  auditors  presented  or  discussed  other  audit  approaches. 

Recommendation 

We  recommend  that  the  AAA  Program  Director  for  Intelligence  and  Security  audits 
remind  auditors  to  include  documentation  of  meetings  with  AAA  audit  management 
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regarding  any  audit  planning  decisions  made  to  comply  with  USAAA  Regulation  No. 
36-2. 

Management  Comments 

The  Army  Audit  Agency’s  Deputy  Auditor  General  concurred  with  our  recommendation 
and  stated  that  on  December  7,  201 1,  the  program  director  sent  an  e-mail  to  all  special 
access  program  personnel  discussing  the  results  of  the  quality  control  review  and  re¬ 
emphasized  the  requirements  of  USAAA  Regulation  No.  36-2  (Planning  the  Audit) 
related  to  the  need  for  teams  to  document  in  working  papers  the  decisions  made  at 
planning  decision  meetings. 

Reviewer  Response 

Management  comments  are  responsive.  The  program  director’s  December  7,  201 1 
e-mail  requires  that  the  planning  decision  gate  meetings  be  documented  using  a  working 
paper  or  memorandum  for  the  record.  The  e-mail  also  states  that  the  working  paper  or 
memorandum  for  the  record  should  include  those  who  attended  the  meeting  and  the 
decisions  made  at  the  meeting  to  comply  with  USAAA  Regulation  No.  36-2. 

Audit  Documentation 

We  found  that  for  one  of  the  two  audits  reviewed,  auditors  did  not  prepare  working 
papers  or  memorandums  for  record  to  document  in-process  reviews  with  audit 
management  and  Army  command. 

GAGAS  7.77  (2007  Revision)  states  that  auditors  should  prepare  audit  documentation 
related  to  planning,  conducting,  and  reporting  for  each  audit.  Auditors  should  prepare 
audit  documentation  in  sufficient  detail  to  enable  an  experienced  auditor,  having  no 
previous  connection  to  the  audit,  to  understand  from  the  audit  documentation  the  nature, 
timing,  extent,  and  results  of  audit  procedures  performed,  the  audit  evidence  obtained  and 
its  source,  and  the  conclusions  reached,  including  evidence  that  supports  the  auditors’ 
significant  judgments  and  conclusions. 

USAAA  Regulation  No.  36-3,  Audit  Survey  and  Execution,  dated  October  17,  2003, 
Chapter  4,  Section  4,  In-Process  Review  states  that  the  audit  team  will  hold  an  in-process 
review  (audit  update  briefing)  with  command  personnel  45  to  60  days  after  the  entrance 
conference.  The  purpose  of  the  in-process  review  is  for  the  audit  team  to  assess  audit 
progress  and  provide  command  an  update  on  the  audit  status  and  the  plan  for  audit 
execution.  This  briefing  also  provides  command  with  an  opportunity  to  provide  input  on 
the  survey  results  and  execution  phase. 

USAAA  Regulation  No.  36-3,  Audit  Survey  and  Execution,  dated  October  17,  2003, 
Chapter  4,  Section  5,  Documenting  the  In-Process  Review  states  that  the  Auditor-in- 
Charge  or  designated  team  member  should  document  the  results  and  decisions  made  at 
the  in-process  review  in  a  memorandum  for  the  record.  This  memorandum  should 
include: 

•  Date,  time,  and  location  of  the  meeting. 
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•  List  of  attendees  and  contact  information  (phone  number,  office  location,  e-mail 
address). 

•  Summary  of  meeting  results  including  command  comments  and  concerns. 

•  Agreements  made  between  the  audit  team  and  command. 

•  A  copy  of  the  charts  used  to  provide  the  briefing  (as  an  attachment). 

The  auditors  should  file  the  in-process  review  memorandum  in  the  Correspondence  and 
Conference  Notes  section  of  the  working  paper  file. 

We  identified  audit  files  that  contained  briefing  charts  discussed  with  audit  management 
and  Army  command,  but  the  audit  files  did  not  contain  a  memorandum  for  record. 
Therefore,  we  could  not  determine  who  attended  the  meetings  and  if  audit  management 
or  Army  command  had  any  comments  or  concerns  relating  to  the  briefings. 

Recommendation 

We  recommend  that  the  AAA  Program  Director  for  Intelligence  and  Security  audits 
remind  auditors  to  document  results  and  decisions  made  at  in-process  reviews  in  an  audit 
working  paper  or  memorandum  to  comply  with  USAAA  Regulation  No.  36-3. 

Management  Comments 

The  Army  Audit  Agency’ s  Deputy  Auditor  General  concurred  with  our  recommendation 
and  stated  that  on  December  7,  201 1,  the  program  director  sent  an  e-mail  to  all  special 
access  program  personnel  discussing  the  results  of  the  quality  control  review  and 
re-emphasized  the  requirements  of  USAAA  Regulation  No.  36-3  (Audit  Survey  and 
Execution)  related  to  the  need  for  teams  to  document  the  decisions  made  during 
in-process  reviews. 

Reviewer  Response 

Management  comments  are  responsive.  The  program  director’s  e-mail  dated 
December  7,  2011,  requires  that  auditors  document  the  internal  in-process  reviews  and 
command  in-process  reviews  using  a  working  paper  or  memorandum  for  the  record. 

Quality  Control 

We  found  that  for  one  of  the  two  audits  reviewed,  the  working  papers  did  not  include 
a  completed  quality  control  checklist. 

GAGAS  3.50a  (2007  Revision)  states  that  each  audit  organization  performing  audits 
or  attestation  engagements  in  accordance  with  GAGAS  must  establish  a  system  of 
quality  control  that  is  designed  to  provide  the  audit  organization  with  reasonable 
assurance  that  the  organization  and  its  personnel  comply  with  professional  standards 
and  applicable  legal  and  regulatory  requirements. 

USAAA  Regulation  36-62,  Quality  Assurance  Program,  dated  April  16,  2008,  Section 
2-3,  Quality  Control  Checklist  states  the  following: 
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a.  The  auditor-in-charge  and  audit  manager  will  complete  the  appropriate  quality 
control  checklist  to  document  compliance  with  GAGAS  throughout  the  audit. 

b.  The  quality  control  checklists  provide  a  roadmap  for  the  audit;  they  include 
separate  sections  on  the  planning,  survey,  and  execution;  report  writing;  and 
report  reply  process  phases. 

c.  Auditors-in-charge  are  required  to  answer  each  element  of  the  checklist  with  a 
“yes,”  “no,”  or  “not  applicable;”  initial  that  each  quality  control  step  was 
completed;  provide  relevant  working  paper  citations  for  positive  responses; 
and  explain  negative  answers  or  steps  marked  as  not  applicable. 

d.  Before  the  final  report  is  issued,  both  the  audit  manager  and  the  program 
director  will  sign  the  final  page  of  the  quality  control  checklist.  The  audit 
manager’s  signature  validates  that  the  audit  complied  with  GAGAS  and 
Agency  policies.  The  program  director’s  signature  indicates  that  nothing  came 
to  their  attention  that  the  audit  wasn’t  conducted  in  accordance  with  GAGAS 
and  Agency  policies. 

e.  The  completed  checklist  and  signatures  will  be  documented  in  the  working 
paper  files. 

The  audit  working  paper  files  did  not  include  a  completed  quality  control  checklist. 
Specifically,  the  checklist  areas  relating  to  reporting  and  the  command  reply  process  were 
not  completed.  The  auditors  did  not  answer  the  checklist  sections  of  the  reporting  and  the 
reply  process  with  a  “yes,”  “no,”  or  “not  applicable.”  AAA  issued  the  final  report 
without  completing  all  of  the  sections  of  the  checklist.  The  auditors  indicated  that  it  was 
an  oversight  that  the  checklist  was  not  been  completed. 

Recommendation 

We  recommend  that  the  AAA  Program  Director  for  Security  and  Intelligence  follow  the 
AAA  quality  assurance  program  and  ensure  that  all  sections  of  the  quality  control 
checklist  are  completed  and  a  copy  of  the  checklist  is  maintained  in  the  audit  files. 

Management  Comments 

The  Army  Audit  Agency’s  Deputy  Auditor  General  concurred  with  our  recommendation 
and  stated  that  on  December  7,  201 1,  the  program  director  sent  an  e-mail  to  all  special 
access  program  personnel  discussing  the  results  of  the  quality  control  review  and  re¬ 
emphasized  the  requirements  of  USAAA  Regulation  No.  36-62  (Quality  Assurance 
Program)  related  to  the  need  for  teams  to  complete  all  sections  of  the  quality  control 
checklist  and  to  include  a  copy  of  the  checklist  in  the  working  papers. 

Reviewer  Response 

Management  comments  are  responsive.  The  program  director’s  e-mail  dated 
December  7,  201 1,  reminded  the  special  access  program  personnel  to  complete  all 
sections  of  the  quality  control  checklist  and  to  include  a  copy  of  the  checklist  in  the 
working  papers. 
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Appendix  B.  Scope  and  Methodology 

We  limited  our  review  to  the  adequacy  of  AAA  SAP  audits’  compliance  with  quality 
policies,  procedures,  and  standards.  We  judgmentally  selected  two  SAP  audits  from  a 
universe  of  four  SAP  audit  reports  issued  by  AAA  SAP  auditors  during  FY  2009  and 
FY  2010.  We  tested  each  audit  for  compliance  with  the  AAA  system  of  quality  control. 
The  Naval  Audit  Service  conducted  a  review  of  the  AAA  internal  quality  control  system 
for  non-SAP  audits  and/or  attestation  engagements,  and  will  issue  a  separate  report.  The 
Deputy  Inspector  General  for  Audit  Policy  and  Oversight  will  issue  an  overall  opinion 
report  on  the  AAA  internal  quality  control  system  that  will  include  the  combined  results 
of  the  SAP  and  non-SAP  audit  reviews. 

In  performing  our  review,  we  considered  the  requirements  of  quality  control  standards 
contained  in  the  2007  revision  of  GAGAS  issued  by  the  Comptroller  General  of  the 
United  States.  GAGAS  3.56  states: 

The  audit  organization  should  obtain  an  external  peer  review  sufficient 
in  scope  to  provide  a  reasonable  basis  for  determining  whether  the  audit 
organization  is  complying  with  its  quality  control  system  in  order  to 
provide  the  audit  organization  with  reasonable  assurance  of  conforming 
with  applicable  professional  standards. 

We  conducted  this  review  in  accordance  with  standards  and  guidelines  established  in  the 
March  2009  Council  of  the  Inspectors  Generals  on  Integrity  and  Efficiency  “Guide  for 
Conducting  External  Peer  Reviews  of  Audit  Organizations  of  the  Federal  Offices  of 
Inspector  General,”  and  the  Quality  Standards  for  Inspection  and  Evaluation.  The  Naval 
Audit  Service  used  this  guide  in  review  of  non-SAP  audits  at  the  AAA.  We  reviewed 
audit  documentation,  interviewed  AAA  auditors,  and  reviewed  AAA  internal  audit 
policies.  We  reviewed  the  DOD  OIG  Report  No.  D-2008-6-006,  “Quality  Control 
Review  of  the  Army  Audit  Agency’s  Special  Access  Program  Audits”  dated  June  2, 

2008.  We  performed  this  review  from  September  to  November  at  two  AAA  offices. 

We  used  the  following  criteria  to  select  the  audits  under  review: 

•  Worked  backward  starting  with  the  FY  2010  audits  in  order  to  review  the  most 
current  quality  assurance  procedure  in  place. 

•  Avoided  audits  with  multiple  SAPs  associated  with  the  audit  for  ease  of  access. 

•  Avoided  audits  that  have  the  same  or  similar  titles  to  ensure  review  of  multiple 
types  of  projects. 

Limitations  of  Review 

Our  review  would  not  necessarily  disclose  all  weaknesses  in  the  system  of  quality  control 
or  all  instances  of  noncompliance  because  we  based  our  review  on  selective  tests.  There 
are  inherent  limitations  in  considering  the  potential  effectiveness  of  any  quality  control 
system.  In  performing  most  control  procedures,  departures  can  result  from 
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misunderstanding  of  instructions,  mistakes  of  judgment,  carelessness,  or  other  human 
factors.  Projecting  any  evaluation  of  a  quality  control  system  into  the  future  is  subject  to 
the  risk  that  one  or  more  procedures  may  become  inadequate  because  conditions  may 
change  or  the  degree  of  compliance  with  procedures  may  deteriorate. 
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Department  of  the  Army,  U.S.  Army  Audit 
Agency  Comments 


SAAG-FFZ 


DEPARTMENT  OF  THE  ARMY 

U.S.  ARMY  AUDIT  AGENCY 
OFFICE  OF  THE  DEPUTY  AUDITOR  GENERAL 
FORCES  AND  FINANCIAL  AUDITS 
3101  PARK  CENTER  DRIVE 
ALEXANDRIA  VA  22302-1 596 


15  December  2011 


MEMORANDUM  FOR  Deputy  Inspector  General  for  Policy  and  Oversight,  Office  of  the 
Inspector  General,  Department  of  Defense,  4800  Mark  Center  Drive,  Alexandria,  VA 
22350-1500 

SUBJECT:  Quality  Control  Review  of  U.S.  Army  Audit  Agency's  Special  Access 
Program  Audits  (Project  Number:  D2011-DIP0AI-0118  000) 


1 .  We  are  providing  our  written  response  (enclosure)  to  the  quality  review  report  dated 
5  December  201 1  We  concur  with  all  the  suggestions  in  the  report. 

2.  We  thank  you  and  your  staff  for  their  professionalism  in  performing  the  peer  review 
and  for  bringing  to  our  attention  areas  in  which  we  can  improve  our  operations.  We  are 
especially  pleased  with  your  conclusion  that  our  system  of  quality  control  was  operating 
effectively  to  provide  reasonable  assurance  that  special  access  program  personnel 
were  following  established  policies,  procedures,  and  applicable  auditing  standards. 

3.  If  you  have  any  questions  or  need  additional  information,  please  contact  me  at 
(703)  428-7222  or  e-mail  Elizabeth.Casciaro@us.armv.mil. 


FOR  THE  AUDITOR  GENERAL 

Enel  KEVIN  F.  KELLY 

Deputy  Auditor  General 
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Comments  on  Suggestions  in  Quality  Control  Review 
of  U.S.  Army  Audit  Agency’s  Special  Access  Program  Audits 
(Project  Number:  D2011-DIP0AI-01 18.000) 


Overall  We  are  pleased  with  your  overall  conclusion  that  U.S.  Army  Audit  Agency’s 
(USAAA's)  system  of  quality  control  for  special  access  programs  was  operating 
effectively  to  provide  reasonable  assurance  that  personnel  were  following  established 
policies,  procedures,  and  applicable  auditing  standards.  We  also  appreciate  the 
suggested  actions  you  provided.  On  1 3  December  201 1 ,  the  Program  Director  for 
Intelligence  and  Security  Audits  briefed  the  results  of  the  peer  review  to  the  staff.  The 
Program  Director  discussed  your  conclusions  and  emphasized  the  importance  of  the 
issues  you  identified  in  your  suggested  actions.  The  Agency’s  Quality  Assurance 
Branch  will  also  conduct  post-audit  reviews  of  selected  special  access  program  audits 
to  verify  compliance  with  these  requirements.  The  following  comments  describe 
additional  actions  we  took  for  each  suggestion  in  the  report. 

Suggestion  1  The  Program  Director  for  Intelligence  and  Security  Audits  should  remind 
auditors  to  follow  USAAA  guidance  for  preparing,  reviewing,  and  documenting  auditor 
independence  for  all  auditors  assigned  to  the  audit  to  include  audit  managers. 

USAAA  Comments.  Concur.  On  7  December  201 1 ,  the  Program  Director  sent  an 
e-mail  to  all  special  access  program  personnel  discussing  the  results  of  the  peer 
review  and  re-emphasizing  requirements  of  USAAA  Regulation  36-3  (Audit  Survey 
and  Execution)  related  to  the  need  for  auditors,  specialists,  and  independent 
reviewers  to  review  and  sign  independence  statements  upon  assignment  to  an 
engagement.  Further,  In  FY  1 1 ,  we  established  the  requirement  for  Agency 
specialists  (along  with  Program  Directors  and  Deputy  Auditors  General)  to  prepare 
annual  independence  declaration  statements  and  to  post  them  online  in  a 
centralized  folder. 

Suggestion  2.  The  Program  Director  for  Intelligence  and  Security  Audits  should  remind 
auditors  to  include  documentation  of  meetings  with  USAAA  audit  management 
regarding  any  audit  planning  decisions  made  to  comply  with  USAAA  Regulation  36-2 
(Planning  the  Audit). 

USAAA  Comments.  Concur.  On  7  December  201 1 ,  the  Program  Director  sent  an 
e-mail  to  all  special  access  program  personnel  discussing  the  results  of  the  peer 
review  and  re-emphasizing  the  requirements  of  USAAA  Regulation  36-2  related  to 
the  need  for  teams  to  document  in  working  papers  the  decisions  made  at  the 
planning  decision  meeting. 

Suggestion  3  The  Program  Director  for  Intelligence  and  Security  Audits  should  remind 
auditors  to  document  results  and  decisions  made  at  in-process  reviews  in  an  audit 
working  paper  or  memorandum  to  comply  with  USAAA  Regulation  36-3. 

USAAA  Comments.  Concur.  On  7  December  201 1 ,  the  Program  Director  sent  an 
e-mail  to  all  special  access  program  personnel  discussing  the  results  of  the  peer 
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review  and  re-emphasizing  the  requirements  of  USAAA  Regulation  36-3  related  to 
the  need  for  teams  to  document  in  working  papers  the  decisions  made  during  in- 
process  reviews. 

Suggestion  4.  The  Program  Director  for  Intelligence  and  Security  Audits  follow  the 
USAAA  quality  assurance  program  and  ensure  that  all  sections  of  the  quality  control 
checklist  are  completed  and  a  copy  of  the  checklist  is  maintained  in  the  audit  files. 

USAAA  Comments.  Concur.  On  7  December  201 1 ,  the  Program  Director  sent  an 
e-mail  to  all  special  access  program  personnel  discussing  the  results  of  the  peer 
review  and  re-emphasizing  requirements  of  USAAA  Regulation  36-62  (Quality 
Assurance  Program)  related  to  the  need  for  teams  to  complete  all  sections  of  the 
quality  control  checklist  and  to  include  a  copy  of  the  checklist  in  the  working  papers. 
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